Investigation Findings
Try to replicate the issue with alfrescoNTLM only, Kerberos without SSO, and Kerberos with SSO enabled. This issue only replicated in v5.0.1 when configureed with Kerberos SSO. Not replicate with alfrescoNTLM and Kerberos without SSO.

Per the log stack trace, it seems like this is due to Kerberos SSO failed to fall back to basic NTLM in 5.0.1, and I found one currently opened jira with this issue: ACE-2678 remain unfix. Another bug in v5.0.1 with Kerberos SSO related to rss feed and ical feed also blocked by ACE-2678 is ACE-3767.

The customer confirmed that he did not experience this issue in 4.1/5.0.1 when using /alfresco/cmisatom Atom Binding URL.